fix(knowledge): redact saved AWS session secrets and share the credential service check

A saved AWS credential resolves to an empty bearer with its secret key and
session token in awsSession, so redacting accessToken alone left them in
provider validation text. Both validation sites now redact every secret the
resolved token carries (connectorTokenSecrets).

Setup and access updates now share requireConnectorCredentialService, so a
key connector's saved-credential setup refuses a missing service config
instead of skipping the provider check.

Author: waleedlatif1

apps/sim/lib/knowledge/application/connector-access.ts

@@ -35,6 +35,7 @@ import {
   mirrorsSourceAcls,
   supportsConnectorAccessMode,
 } from '@/lib/knowledge/connectors/access-modes'
+import { requireConnectorCredentialService } from '@/lib/knowledge/connectors/credential-service'
 import { validateKnowledgeConnectorMembersBinding } from '@/lib/knowledge/connectors/member-access'
 import {
   provisionKnowledgeConnectorMembersBinding,
@@ -50,7 +51,6 @@ import {
 import { getKnowledgeConnector } from '@/lib/knowledge/orchestration/connectors'
 import type { KnowledgeOperationSource } from '@/lib/knowledge/orchestration/shared'
 import { requireOrganizationSearchApproval } from '@/lib/knowledge/search/integration-policy'
-import { getServiceConfigByProviderId, getServiceConfigByServiceId } from '@/lib/oauth'
 import { getConnectorCredentialService } from '@/connectors/auth'
 import { getConnectorMeta } from '@/connectors/registry'
 import type { ConnectorMeta } from '@/connectors/types'
@@ -435,15 +435,7 @@ async function requireUsableCredential(input: {
     )
   }
   await requireConnectorSavedCredentialSetup(auth, input.credentialId)
-  const service =
-    getServiceConfigByServiceId(credentialService) ??
-    getServiceConfigByProviderId(credentialService)
-  if (!service) {
-    throw new OrchestrationError(
-      'validation',
-      `${input.connectorMeta.name} has no OAuth service to validate the credential against`
-    )
-  }
+  const service = requireConnectorCredentialService(input.connectorMeta)
   const token = await resolveConnectorCredentialAccessToken({
     principal: input.principal,
     credentialId: input.credentialId,

apps/sim/lib/knowledge/application/connectors.test.ts

@@ -96,6 +96,15 @@ vi.mock('@/connectors/registry.server', () => ({
       auth: { mode: 'oauth', requiredScopes: ['read:confluence-content.all'] },
       validateConfig: hoisted.validateConnectorConfig,
     },
+    s3: {
+      name: 'Amazon S3',
+      auth: {
+        mode: 'apiKey',
+        label: 'Secret Access Key',
+        savedCredential: { provider: 'aws', label: 'Saved AWS credential' },
+      },
+      validateConfig: hoisted.validateConnectorConfig,
+    },
     google_drive: {
       name: 'Google Drive',
       auth: {
@@ -1090,6 +1099,52 @@ describe('organization connector credential authorization', () => {
     }
   )
 
+  it.each(['result', 'exception'] as const)(
+    'redacts a saved AWS session from settings validation %s',
+    async (failure) => {
+      const awsSession = {
+        accessKeyId: 'ASIAEXAMPLE',
+        secretAccessKey: 'session/secret',
+        sessionToken: 'session-token',
+      }
+      mocks.authorizeOrganizationCredentialUse.mockResolvedValueOnce({
+        credential: { ...credential, providerId: 'aws' },
+        userId: principal.userId,
+      })
+      internalAwsCredentialsMockFns.mockResolveAuthorizedAwsCredential.mockResolvedValueOnce(
+        awsSession
+      )
+      const message = `Denied ${awsSession.secretAccessKey} ${awsSession.sessionToken}`
+      if (failure === 'exception') {
+        mocks.validateConnectorConfig.mockRejectedValueOnce(
+          new OrchestrationError('validation', message)
+        )
+      } else {
+        mocks.validateConnectorConfig.mockResolvedValueOnce({ valid: false, error: message })
+      }
+      const result = validateConnectorSourceConfig({
+        principal,
+        requestId: 'request',
+        organizationId: 'org',
+        actingUserId: principal.userId,
+        sourceConfig: { region: 'us-east-1', bucket: 'docs' },
+        connector: {
+          id: 'connector-s3',
+          connectorType: 's3',
+          credentialId: credential.id,
+          encryptedApiKey: null,
+          accessMode: 'workspace',
+        } as Parameters<typeof validateConnectorSourceConfig>[0]['connector'],
+      })
+      const redacted = 'Denied [REDACTED] [REDACTED]'
+      if (failure === 'exception') {
+        await expect(result).rejects.toMatchObject({ code: 'validation', message: redacted })
+      } else {
+        await expect(result).resolves.toEqual({ errorCode: 'validation', message: redacted })
+      }
+    }
+  )
+
   it('does not mint a token after the credential creator leaves the organization', async () => {
     mocks.resolveTokenIdentity.mockResolvedValueOnce(null)
     await expect(resolveConnectorCredentialAccessToken(input)).resolves.toBeNull()

apps/sim/lib/knowledge/application/connectors.ts

@@ -59,9 +59,11 @@ import {
 import {
   type ConnectorAccessToken,
   ConnectorAwsCredentialError,
+  connectorTokenSecrets,
   resolveConnectorAccessToken,
   syncContextForToken,
 } from '@/lib/knowledge/connectors/access-token'
+import { requireConnectorCredentialService } from '@/lib/knowledge/connectors/credential-service'
 import { requiresConnectorIndexing } from '@/lib/knowledge/connectors/indexing-policy'
 import {
   provisionKnowledgeConnectorMembersBinding,
@@ -115,11 +117,7 @@ import type {
   KnowledgeOperationSource,
   KnowledgeOrchestrationResult,
 } from '@/lib/knowledge/orchestration/shared'
-import {
-  credentialProviderMatchesService,
-  getServiceConfigByServiceId,
-  type ServiceProviderIdentity,
-} from '@/lib/oauth'
+import { credentialProviderMatchesService, type ServiceProviderIdentity } from '@/lib/oauth'
 import { ServiceAccountTokenError } from '@/lib/oauth/credential-service'
 import { CAPABILITY_RULES, refuseCapability } from '@/lib/permission-groups/capabilities'
 import { resolvePermissionGroupConfig } from '@/lib/permission-groups/config-scope.server'
@@ -501,19 +499,21 @@ export async function validateConnectorSourceConfig(input: {
       )
     }
   }
+  const secrets = connectorTokenSecrets(resolved)
   const validation = await connectorConfig
     .validateConfig(resolved.accessToken, input.sourceConfig, validationContext)
     .catch((error: unknown) => {
       const sanitized = toError(error)
-      sanitized.message = redactKnownSensitiveValues(sanitized.message, [resolved.accessToken])
+      sanitized.message = redactKnownSensitiveValues(sanitized.message, secrets)
       throw sanitized
     })
   return validation.valid
     ? null
     : {
-        message: redactKnownSensitiveValues(validation.error || 'Invalid source configuration', [
-          resolved.accessToken,
-        ]),
+        message: redactKnownSensitiveValues(
+          validation.error || 'Invalid source configuration',
+          secrets
+        ),
         errorCode: 'validation',
       }
 }
@@ -757,8 +757,8 @@ async function executeCreateKnowledgeConnector({
   await requireConnectorSavedCredentialSetup(connectorMeta.auth, input.credentialId)
   /** A key connector's saved credential must be of its declared service, as on an access update. */
   const savedCredentialService =
-    connectorMeta.auth.mode === 'apiKey' && connectorMeta.auth.savedCredential
-      ? (getServiceConfigByServiceId(connectorMeta.auth.savedCredential.provider) ?? undefined)
+    connectorMeta.auth.mode === 'apiKey' && connectorMeta.auth.savedCredential && input.credentialId
+      ? requireConnectorCredentialService(connectorMeta)
       : undefined
   if (
     context.knowledgeBase.isSearchIndex &&

apps/sim/lib/knowledge/connectors/access-token.ts

@@ -56,6 +56,20 @@ export interface ConnectorAccessToken {
   expiresAt?: Date
 }
 
+/**
+ * Every secret a resolved token carries, for redacting provider text that may
+ * echo one back. A saved AWS credential's secrets sit in `awsSession`, not in
+ * the empty bearer, so callers redact this list rather than `accessToken` alone.
+ */
+export function connectorTokenSecrets(token: ConnectorAccessToken): string[] {
+  return [
+    token.accessToken,
+    ...(token.awsSession
+      ? [token.awsSession.secretAccessKey, token.awsSession.sessionToken ?? '']
+      : []),
+  ]
+}
+
 /** The connector-facing service that a saved AWS credential authenticates. */
 const AWS_CREDENTIAL_SERVICE = 'aws'
 

apps/sim/lib/knowledge/connectors/credential-service.ts

@@ -0,0 +1,31 @@
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import {
+  getServiceConfigByProviderId,
+  getServiceConfigByServiceId,
+  type ServiceProviderIdentity,
+} from '@/lib/oauth'
+import { getConnectorCredentialService } from '@/connectors/auth'
+import type { ConnectorMeta } from '@/connectors/types'
+
+/**
+ * The OAuth service a connector's credential must belong to. Setting up a key
+ * connector on its saved credential and every access update resolve it here, so
+ * a connector whose declared service has no config is refused instead of
+ * skipping the provider check.
+ */
+export function requireConnectorCredentialService(
+  connectorMeta: Pick<ConnectorMeta, 'name' | 'auth'>
+): ServiceProviderIdentity {
+  const credentialService = getConnectorCredentialService(connectorMeta.auth)
+  const service = credentialService
+    ? (getServiceConfigByServiceId(credentialService) ??
+      getServiceConfigByProviderId(credentialService))
+    : null
+  if (!service) {
+    throw new OrchestrationError(
+      'validation',
+      `${connectorMeta.name} has no OAuth service to validate the credential against`
+    )
+  }
+  return service
+}

apps/sim/lib/knowledge/orchestration/connectors.test.ts

@@ -34,12 +34,14 @@ const {
 
   mockEncryptApiKey,
   mockValidateGitHub,
+  mockValidateS3,
   mockEnqueueConnectorDeletion,
   mockEnqueueConnectorDetachment,
 } = vi.hoisted(() => ({
   mockDispatchSync: vi.fn(),
   mockEncryptApiKey: vi.fn(),
   mockValidateGitHub: vi.fn(),
+  mockValidateS3: vi.fn(),
   mockEnqueueConnectorDeletion: vi.fn(),
   mockEnqueueConnectorDetachment: vi.fn(),
 }))
@@ -76,6 +78,16 @@ vi.mock('@/connectors/registry.server', () => ({
       configFields: [],
       validateConfig: mockValidateGitHub,
     },
+    s3: {
+      name: 'Amazon S3',
+      auth: {
+        mode: 'apiKey',
+        label: 'Secret Access Key',
+        savedCredential: { provider: 'aws', label: 'Saved AWS credential' },
+      },
+      configFields: [],
+      validateConfig: mockValidateS3,
+    },
     notion: {
       auth: { mode: 'apiKey', optional: true },
       configFields: [],
@@ -188,6 +200,35 @@ describe('performCreateKnowledgeConnector', () => {
     }
   )
 
+  it.each(['result', 'exception'])(
+    'redacts a saved AWS session from provider validation %s errors',
+    async (failure) => {
+      const awsSession = {
+        accessKeyId: 'ASIAEXAMPLE',
+        secretAccessKey: 'session/secret',
+        sessionToken: 'session-token',
+      }
+      const message = `Denied ${awsSession.secretAccessKey} ${awsSession.sessionToken}`
+      if (failure === 'result')
+        mockValidateS3.mockResolvedValueOnce({ valid: false, error: message })
+      else mockValidateS3.mockRejectedValueOnce(new OrchestrationError('validation', message))
+      const request = performCreateKnowledgeConnector({
+        ...createParams,
+        connectorType: 's3',
+        credentialId: 'aws-credential',
+        resolveAccessToken: vi.fn().mockResolvedValue({ accessToken: '', awsSession }),
+      })
+      const expected = { errorCode: 'validation', error: 'Denied [REDACTED] [REDACTED]' }
+      if (failure === 'result') await expect(request).resolves.toMatchObject(expected)
+      else
+        await expect(request).rejects.toMatchObject({
+          code: expected.errorCode,
+          message: expected.error,
+        })
+      expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+    }
+  )
+
   it('validates and encrypts a GitHub PAT without resolving an OAuth account or returning the secret', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'kb-1' }])
     dbChainMockFns.returning.mockResolvedValueOnce([

apps/sim/lib/knowledge/orchestration/connectors.ts

@@ -43,6 +43,7 @@ import {
 } from '@/lib/knowledge/connectors/access-modes'
 import {
   type ConnectorAccessToken,
+  connectorTokenSecrets,
   syncContextForToken,
 } from '@/lib/knowledge/connectors/access-token'
 import { enqueueConnectorDeletion } from '@/lib/knowledge/connectors/deletion'
@@ -300,6 +301,7 @@ export async function performCreateKnowledgeConnector(
   let resolvedCredentialId: string | null = null
   let resolvedEncryptedApiKey: string | null = null
   let accessToken: string | null = null
+  let tokenSecrets: string[] = []
   let tokenContext: Record<string, unknown> = {}
   const apiKeyConfig = getConnectorApiKeyConfig(connectorConfig.auth)
   if (apiKey && (!apiKeyConfig || accessMode === 'members')) {
@@ -338,6 +340,7 @@ export async function performCreateKnowledgeConnector(
       return fail('API key is required', 'validation')
     }
     accessToken = apiKey ?? ''
+    tokenSecrets = [accessToken]
   } else if (!membersBinding || credentialId) {
     if (!credentialId) {
       return fail('Credential is required', 'validation')
@@ -352,6 +355,7 @@ export async function performCreateKnowledgeConnector(
       return fail('Credential has no access token. Please reconnect your account.', 'validation')
     }
     accessToken = token.accessToken
+    tokenSecrets = connectorTokenSecrets(token)
     tokenContext = syncContextForToken(token)
     resolvedCredentialId = credentialId
   }
@@ -367,13 +371,13 @@ export async function performCreateKnowledgeConnector(
       .validateConfig(accessToken, sourceConfig, validationContext)
       .catch((error: unknown) => {
         const sanitized = toError(error)
-        sanitized.message = redactKnownSensitiveValues(sanitized.message, [accessToken])
+        sanitized.message = redactKnownSensitiveValues(sanitized.message, tokenSecrets)
         throw sanitized
       })
     if (!configValidation.valid) {
       return fail(
         (configValidation.error &&
-          redactKnownSensitiveValues(configValidation.error, [accessToken])) ||
+          redactKnownSensitiveValues(configValidation.error, tokenSecrets)) ||
           `The ${connectorType} connector rejected sourceConfig without a reason — re-check its required fields with \`sim connector-types list --detail full\` (GET /api/v2/connector-types?detail=full) before retrying; the same config will fail again.`,
         'validation'
       )